GoAccess CVE-2026-55777

GoAccess is a real-time, terminal-based and browser-based web log analyzer (CPE: cpe:2.3:a:allinurl:goaccess:*:*:*:*:*:*:*:*). The affected code path is the parse_ios() function in src/opesys.c, which parses iOS-style User-Agent strings to extract OS version information from web server access logs. The root cause is classified as CWE-125 (Out-of-bounds Read): the variable offset, which encodes the distance from the start of the agent string to a matched keyword, is passed directly as the third argument (byte count) to memmove() - a length parameter - rather than computing the correct length as (q - p) + 1, where p and q delimit the actual suffix to be moved. Because offset is derived from attacker-supplied User-Agent content present in a processed log file, an adversary can precisely control how far past the heap allocation the read extends, up to roughly 4 KB. The corrected commit (ba813ed97d998dbdcb8d87e178799a4bb2da9e81) replaces the erroneous memmove(agent + tlen, agent + offset, offset) with memmove(agent + tlen, p, (size_t)(q - p) + 1), decoupling the source pointer from the length calculation.